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Cloudflare’s Zero Trust Platform 
The fastest Zero Trust browsing and application access platform 


When applications and users left the walls of the enterprise network, security teams had to compromise on how to 
keep data safe. The location-centric methods they deployed to secure employee traffic — like VPNs, access control 
lists, and IP allow-listing — have now broken down under pressure, leaving companies with limited visibility, conflicting 
configurations, and excessive risk. 


Cloudflare Zero Trust increases visibility, eliminates complexity, and reduces risks as employees connect to 
applications and the Internet. It runs on the world’s fastest edge network to deploy faster and perform better than 
other providers. 


Verify, filter, inspect, and isolate traffic between any user and app, lightning-fast 
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Global edge Intelligent World's fastest Single-pass Single-pane Programmable 
network routing resolver inspection management interface 
Benefits 
a Reduce excessive trust © Eliminate complexity Restore visibility 
Protect corporate applications with With reduced reliance on legacy Increase visibility with detailed logs 
identity and context-based Zero VPNs and point security products, for DNS, HTTP, login, and in-application 
Trust rules, and isolate endpoints administrators can apply standard activity. Administrators can monitor 
from risks by executing untrusted security controls to all traffic — user activity in self-hosted and 
web code away from devices. regardless of how that connection SaaS apps, with an audit trail to 
starts or where in the network investigate incidents. 
stack it lives. 
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Deployment Outcomes 


80% V 


less time spent resolving IT tickets 
and security posture for employees. 


91% 


reduction in attack surface by placing 
Cloudflare in front of application 
access and internet browsing. 


30 min 


of setup time to unlock faster and 
safer application and Internet access. 


Zero Trust Network Access with Private Routing 


e Protect applications with identity, posture, and context-driven rules 


e Enforce consistent access controls and visibility across cloud, 
on-premise, and SaaS applications 


e Apply strong authentication methods to even legacy applications 


with network firewall and Zero Trust rules 


Secure Web Gateway with Zero Trust Browsing 


e Block phishing and malware with intelligence from our network 


firewall and Zero Trust rules 


e Isolate browsing activity from corporate endpoints, mitigating 


the impact of breaches 


e Stop data from leaving corporate apps and gain Shadow IT visibility 


The Cloudflare Difference 


One management interface 


Provide better ease of use for 
administrators with a natively 
built dashboard for application 
and Internet access including 
integrations with identity providers, 
endpoint protections, and 

network onramps. 


© One consolidated platform 


Reduce complexity with one easy-to- 
manage platform that consolidates 
Secure Web Gateway, Zero Trust 
Network Access, DNS Filtering, 
Cloud Access Security Broker (CASB) 
and Data Loss Prevention into one 
streamlined control plane. Replace 
VPN clients, on-premise firewalls, 
and other legacy security solutions 
as you move security and connectivity 
to the edge. 


jei Unrivaled end-user experience 


Cloudflare routes requests faster 
utilizing optimized, intelligence-driven 
routing across our vast Anycast 
network, with 250+ locations in more 
than 100 countries around the world. 


On average, web apps are accessed 
39% faster and TCP connections see 
a 17% decrease in round trip time. 
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Platform Capabilities 


= Support A Secure connectivity 


Data protection controls 


Copy/Paste, Print, Keyboard 


Device posture using third-party 
integrations and Cloudflare 


v 


CSV-based bulk import for lists 
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Communication channels 24x7x365 Phone Client-based encrypted Win Mac. iOS. Android 
24x7x365 Chat connections to the Internet ChromeOS Linux 
Email (WARP client) : 
Median email response time Less than 1 hour Clientless secure access to self- 2 
hosted and SaaS applications 
A Reduce risk Private connections for self- 
hosted applications and 
BHO MUST NEWN ACCESS = internal IPs and hostnames á 
Secure Web Gateway v (Cloudflare Tunnel) 
> Recursive DNS Filters {v Network-level security for Up to 250 network locations 
F . physical locations P 
> Layer 4 Firewall Filters v 
i i {v 
> Layer 7 Proxy Filters p Editable IP network locations 
> Antivirus | ti [v 7 r fs 
Le a @ Simple interoperability 
> CASB {v 
Endpoint and mobilility 
> Remote Browser Isolation Add on (natively-integrated) management integrations “ 
Split-tunneling for local y 
Increase visibility or VPN connectivity 
Activity log retention 6 months Client self-enrollment for v 
unmanaged devices 
Application groups for sacs A 
ShadowlIT visibility v Authentication supports multiple J 
identity providers concurrently 
Identity-based country, state, g 7 
and device detail views Customizable app launcher {v 
Push logs to cloud storage p Generic and custom connectors Z 
or SIEMs to support SAML and OIDC 
Token-based authentication Y 
Consistent policy for automated services 
_ . Certificate-based auth for loT = 
Custom application, private and other mTLS use cases 
network, and Internet access Unlimited 
policies 
Authentication via enterprise _ 5 Ao SE 
and social IdPs Uptime SLA 100% 
Security categories (13) One of the fastest networks P 
via machine learning and v (<50ms away from 250+ PoPs) 
intelligence feeds 
7 Fastest, privacy-first DNS P 
Content categories (100+) G resolver (7-31ms via 250+ PoPs) 
for acceptable use 
Lightning-fast policy updates y 
Custom block, allow, y (<500ms to 250+ PoPs) 
or decryption bypass lists 
Lightning-fast remote browser 
Granular HTTP and URL rules bd (no pixel pushing — runs on our Add on 
File Types, Upload, Download, network; not a 3rd-party cloud) 


Ready to try Cloudflare Zero Trust? Visit www.cloudflare.com/products/zero-trust/ today 
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